CVE-2020-3569: Cisco IOS XR DVMRP IGMP packet handling memory exhaustion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityRemote, unauthenticated denial of service with CISA KEV exploitation evidence and a CVSS base of 8.6, though impact is availability-only and EPSS probability is modest.

What it is

Cisco IOS XR Software mishandles IGMP packets in its Distance Vector Multicast Routing Protocol (DVMRP) feature, allowing crafted traffic to crash the IGMP process or exhaust device memory. Because the affected process can drag down other processes such as interior and exterior routing protocols, a single remote packet stream can destabilize routing on the device.

Impact

An unauthenticated remote attacker can immediately crash the IGMP process or drive memory exhaustion that makes other processes, including routing protocols, unstable. The result is denial of service on the affected device rather than code execution or data exposure.

Attack surface

Reachable over the network by sending crafted IGMP traffic to an affected device; the CVSS vector shows no privileges and no user interaction required. DVMRP must be relevant to the device's configuration for the vulnerable code path to be exercised.

Exploitation

CVE-2020-3569 is listed in CISA's Known Exploited Vulnerabilities catalog with a 2021-11-03 addition date, indicating exploitation in the wild; EPSS gives a 30-day probability of about 3.3 percent (88th percentile). No ransomware campaign use is documented.

What to do

• Apply the Cisco IOS XR software updates referenced in the vendor advisory cisco-sa-iosxr-dvmrp-memexh-dSmpdvfz.
• If DVMRP is not required, disable the DVMRP feature to remove the vulnerable code path.
• Restrict IGMP and multicast traffic to trusted network segments using infrastructure ACLs and multicast boundary controls.
• Monitor device memory and process health for the IGMP process and routing protocol processes to catch early exhaustion.
• Track CISA KEV remediation due date (2022-05-03) and confirm patched status across the fleet.

Detection

• Alert on IGMP process crashes or restarts in IOS XR logs and syslog.
• Monitor device memory utilization trends for unexplained growth correlated with multicast traffic.
• Watch for routing protocol process instability or adjacency flaps following multicast traffic bursts.
• Baseline and inspect inbound IGMP traffic volumes and sources at network edges for anomalies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.